Managing credentials of multiple users on an electronic device
AssigneeApple Inc.
InventorsKarthik Narayanan, Navin Bindiganavile Suparna, Scott Lopatin
Life of this patent
Estimating the term…
Abstract
Systems, methods, and computer-readable media for managing credentials of multiple users on an electronic device are provided.
Claims20
A method for protecting an electronic device using a device protection server, wherein the electronic device comprises a device identifier, wherein the electronic device further comprises a first suspension token and an associated first credential for a first user associated with a first user identifier, and wherein the electronic device further comprises a second suspension token and an associated second credential for a second user associated with a second user identifier, the method comprising:
- receiving, with the device protection server from the electronic device, device suspension data, the device suspension data comprising:
- the first suspension token;
- the second suspension token;
- the device identifier;
- and
- the second user identifier;
- storing the received device suspension data at the device protection server;
- after the storing, receiving, with the device protection server, a device protection enablement request comprising:
- the device identifier;
- and
- the second user identifier;
- identifying, with the device protection server, each one of the first suspension token and the second suspension token as being stored at the device protection server in the stored device suspension data with both the device identifier and the second user identifier of the received device protection enablement request;
- and
- communicating, from the device protection server to a remote subsystem, credential suspension data that is operative to instruct the remote subsystem to suspend every credential associated with the identified first suspension token and to suspend every credential associated with the identified second suspension token.
A device protection server for protecting an electronic device, wherein the electronic device comprises a device identifier, wherein the electronic device further comprises a first suspension token and an associated first credential for a first user associated with a first user identifier, and wherein the electronic device further comprises a second suspension token and an associated second credential for a second user associated with a second user identifier, the device protection server comprising:
- a memory component comprising a plurality of data entries;
- a communications component operative to receive device suspension data from the electronic device that comprises the first suspension token, the second suspension token, and the second user identifier;
- and
- a processor operative to store in a data entry of the plurality of data entries each one of the first suspension token of the device suspension data and the second suspension token of the device suspension data against the second user identifier of the device suspension data only when no data entry of the plurality of data entries is storing at least one of the first suspension token of the device suspension data or the second suspension token of the device suspension data against the first user identifier.
A method for managing a plurality of credentials on an electronic device using an administration entity subsystem comprising a device protection server and a credential protection server, wherein the electronic device is associated with a device identifier and is used by a first user associated with a first user identifier and by a second user associated with a second user identifier, the method comprising:
- when the first user authenticates the provisioning of a first credential of the plurality of credentials on the electronic device, using the credential protection server to:
- store, at the credential protection server, a first suspension token against the device identifier and against the first user identifier and against a first credential identifier of the first credential;
- and
- provision the first credential and the first suspension token on the electronic device;
- when the second user authenticates the provisioning of a second credential of the plurality of credentials on the electronic device, using the credential protection server to:
- store, at the credential protection server, a second suspension token against the device identifier and against the second user identifier and against a second credential identifier of the second credential;
- and
- provision the second credential and the second suspension token on the electronic device;
- when the second user enables a protection service of the electronic device on the electronic device, using the device protection server to store, at the device protection server, the first suspension token and the second suspension token against the device identifier and against the second user identifier;
- when a protection mode is activated for the protection service of the electronic device enabled by the second user, using the device protection server to:
- authenticate the second user using the second user identifier;
- identify each one of the first suspension token and the second suspension token as stored at the device protection server against the device identifier of the electronic device and against the second user identifier;
- and
- share each one of the identified first suspension token and the identified second suspension token with the credential protection server;
- when each one of the identified first suspension token and the identified second suspension token is shared by the device protection server with the credential protection server, using the credential protection server to:
- suspend each credential of the plurality of credentials that is stored at the credential protection server against the identified first suspension token;
- and
- suspend each credential of the plurality of credentials that is stored at the credential protection server against the identified second suspension token;
- and
- when the second user authenticates the second user on the electronic device using the second user identifier while the second credential is suspended, using the credential protection server to:
- authenticate the second user using the second user identifier from the electronic device;
- and
- unsuspend each credential of the plurality of credentials that has a credential identifier stored at the credential protection server against the second user identifier.
Dependencies are inferred from the claim text.